[WIN32K] Apply Wine commit 147765a by Sam Edwards: Prevent possible buffer overflows...
authorAmine Khaldi <amine.khaldi@reactos.org>
Fri, 29 May 2015 11:03:17 +0000 (11:03 +0000)
committerAmine Khaldi <amine.khaldi@reactos.org>
Fri, 29 May 2015 11:03:17 +0000 (11:03 +0000)
svn path=/trunk/; revision=67948

reactos/win32ss/gdi/ntgdi/freetype.c

index 2486d7f..c106814 100644 (file)
@@ -2062,8 +2062,8 @@ ftGdiGetGlyphOutline(
         case ft_glyph_format_bitmap:
         {
             BYTE *src = ft_face->glyph->bitmap.buffer, *dst = pvBuf;
-            INT w = (ft_face->glyph->bitmap.width + 7) >> 3;
-            INT h = ft_face->glyph->bitmap.rows;
+            INT w = min( pitch, (ft_face->glyph->bitmap.width + 7) >> 3 );
+            INT h = min( height, ft_face->glyph->bitmap.rows );
             while (h--)
             {
                 RtlCopyMemory(dst, src, w);
@@ -2120,7 +2120,7 @@ ftGdiGetGlyphOutline(
         case ft_glyph_format_bitmap:
         {
             BYTE *src = ft_face->glyph->bitmap.buffer, *dst = pvBuf;
-            INT h = ft_face->glyph->bitmap.rows;
+            INT h = min( height, ft_face->glyph->bitmap.rows );
             INT x;
             while (h--)
             {